Обзор уязвимостей в мире WordPress за январь 2021 года
Обзор любезно предоставлен сервисом WPScan, за что им отдельное спасибо.
Уязвимые плагины под WordPress
- Modern Events Calendar Lite < 5.16.6 — Authenticated SQL Injection
- Modern Events Calendar Lite < 5.16.5 — Authenticated Arbitrary File Upload leading to RCE
- Modern Events Calendar Lite < 5.16.5 — Unauthenticated Events Export
- Modern Events Calendar Lite < 5.16.5 — Authenticated Stored Cross-Site Scripting (XSS)
- Super Forms <= 4.9.602 — Unauthenticated PHP4 File Upload to RCE
- uListing < 1.7 — Unauthenticated Arbitrary Post/Page Deletion
- uListing < 1.7 — Unauthenticated SQL Injections
- uListing < 1.7 — Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion
- uListing < 1.7 — Unauthenticated Information Disclosure
- uListing < 1.7 — Unauthenticated WordPress Options Change
- uListing < 1.7 — Unauthenticated Arbitrary Account Change
- uListing < 1.7 — Unauthenticated Arbitrary Account Creation
- Contact Form 7 Database Addon < 1.2.5.6 — CSV Injection
- Doneren met Mollie < 2.8.5 — Unauthorised CSV Export leading to Sensitive Data Disclosure
- Contact Form 7 Database Addon < 1.2.5.4 — Authenticated SQL Injections
- Digital Climate Strike WP <= 1.0.0 — Redirect to Malicious Website due to Compromised JS Asset
- Under Construction < 3.86 — Authenticated Stored Cross-Site Scripting (XSS)
- Stockdio Historical Chart < 2.8.1 — Reflected Cross-Site Scripting (XSS)
- 123ContactForm for WordPress <= 1.5.6 — Unauthenticated Arbitrary File Upload
- 123ContactForm for WordPress <= 1.5.6 — Unauthenticated Arbitrary Post Creation
- 123ContactForm for WordPress <= 1.5.6 — Validation Bypass via Plugin Verification
- e-signature < 1.5.6.8 — Unauthenticated Arbitrary File Upload leading to RCE
- WP Shieldon 1.6.3 — Unauthenticated Cross-Site Scripting (XSS)
- 301 Redirects — Easy Redirect Manager < 2.51 — Authenticated SQL Injection
- Simple Job Board < 2.9.4 — Authenticated Path Traversal Leading to Arbitrary File Download
- FV Flowplayer Video Player < 7.4.38.727 — Authenticated Stored Cross-Site Scripting (XSS)
- Easy Contact Form Pro < 1.1.1.9 — Authenticated Stored Cross-Site Scripting (XSS)
- Elementor Contact Form DB < 1.6 — Unauthenticated & Unauthorised Form Submissions Export
- Elementor Contact Form DB < 1.6 — Plugin Settings Cross-Site Request Forgery
- Orbit Fox by ThemeIsle < 2.10.3 — Authenticated Privilege Escalation
- Orbit Fox by ThemeIsle < 2.10.3 — Authenticated Stored Cross Site Scripting
- WP Quick FrontEnd Editor <= 5.5 — Authenticated Settings Change leading to Stored XSS
- WP Quick FrontEnd Editor <= 5.5 — Authenticated Content Injection
- Custom Global Variables <= 1.0.5 — Stored Cross-Site Scripting (XSS)
- Modal Survey < 2.0.1.8.2 — Authenticated PHP Object Injection
- Modal Survey < 2.0.1.8.2 — Unauthenticated Arbitrary Survey Update, Deletion and Creation
- Modal Survey < 2.0.1.8.2 — Authenticated Reflected Cross-Site Scripting (XSS)
- WP24 Domain Check < 1.6.3 — Authenticated Stored Cross-Site Scripting (XSS)
- Advanced Custom Fields < 5.8.12 — Cross-Site Scripting in Select2 dropdowns
- Elementor < 3.0.14 — SVG Upload Allowed by Default
- Stripe Payments < 2.0.40 — Authenticated Stored Cross-Site Scripting (XSS)
- WP Paginate < 2.1.4 — Authenticated Stored Cross-Site Scripting (XSS)
- Contact Form Submissions <= 1.6.4 — Authenticated SQL Injection
- Contact Form Submissions <= 1.6.4 — Authenticated Double Query SQL injection
